Disabling USB Ports

You can now use the platform usb disable command to disable the USB ports on Cisco Catalyst 8500 Edge Series platforms.

This feature provides an increase in the ACE (Access Control Engine) scale limit per ACL and OGACL(Object Group Access Control List) as the current implementation of CACE (Common Adaptive Classification Engine) has a total limit of only 64K entries. The scale for this feature is 1D and the scale information for OGACL is 3000 ACE entries per OGACL, 2400 OGs and 100 networks per OG.

The ip nat settings log-destination command is introduced in Carrier Grade Network Address Translation (CGN) mode to include the destination IP address and the destination port details in the add and delete HSL records.

IPsec Dual Stack Support on Non Cisco Devices

This feature provides the capabilities to carry both IPv4 and IPv6 traffic using a single IPsec Security Association (SA) that is tunnelled over IPv4. From IOS XE release 17.9.1a onwards, Cisco supports specific subnets in the access control list when the ingress end of the tunnel interface is configured with a third party IPsec client. With the introduction of the SVTI single security association dual stack feature, you can now manage the business-to-business services and other IOT business efficiently.

Support for Unicast-to-Multicast Destination Reflection

This feature introduces support for configuration of unicast-to-multicast destination reflection to facilitate unicast-to-multicast destination translation and unicast-to-multicast destination splitting. It also provides the capability for users to translate externally received unicast destination addresses to multicast addresses.

MACsec Extended Packet Numbering (XPN) Support

This enhancement introduces support for extending the packet number (PN) for MACsec frames from 32-bit to 64-bit. The 64-bit extended packet number (XPN) eliminates the need for frequent SAK(Security Association Key) rekey due to exhaustion of the 32-bit PN that may occur in high-capacity links.

Support for BGP additional paths with label-unicast unique mode

This enhancement introduces support for configuring BGP additional paths when label-unicast unique mode is configured.

Smart Licensing Using Policy Features

New mechanism to send data privacy related information

A new mechanism to send data privacy related information was introduced. This information is no longer included in a RUM report.

If data privacy is disabled (no license smart privacy{all|hostname|version} command in global configuration mode), data privacy related information is sent in a separate sync message or offline file.

Depending on the topology you have implemented, the product instance initiates the sending of this information in a separate message, or CSLU and SSM On-Prem initiates the retrieval of this information from the product instance, or this information is saved in an offline file.

For more information, see license smart (global config)

Hostname support

Support for sending hostname information was introduced.

If you configure a hostname on the product instance and disable the corresponding privacy setting (no license smart privacy hostname command in global configuration mode), hostname information is sent from the product instance, in a separate sync message or offline file.

Depending on the topology you have implemented, the hostname information is received by CSSM, CSLU, and SSM On-Prem. It is then displayed on the corresponding user interface.

For more information, see license smart (global config)

With the introduction of this enhancement, the hostname limitation which existed from Cisco IOS XE Amsterdam 17.3.2 to Cisco IOS XE Cupertino 17.8.x – is removed. In these earlier releases, hostname information is not sent or displayed on various licensing utilities (CSSM, CSLU, and SSM On-Prem).

RUM Report Throttling

For all topologies where the product instance initiates communication, the minimum reporting frequency is throttled to one day. This means the product instance does not send more than one RUM report a day.

The affected topologies are: Connected Directly to CSSM, Connected to CSSM Through CSLU (product instance-initiated communication), CSLU Disconnected from CSSM (product instance-initiated communication), and SSM On-Prem Deployment (product instance-initiated communication).

This resolves the problem of too many RUM reports being generated and sent for certain licenses. It also resolves the memory-related issues and system slow-down that was caused by an excessive generation of RUM reports.

You can override the reporting frequency throttling, by entering the license smart sync command in privileged EXEC mode. This triggers an on-demand synchronization with CSSM or CSLU, or SSM On-Prem, to send and receive any pending data.

RUM report throttling also applies to the Cisco IOS XE Amsterdam 17.3.6 and later releases of the 17.3.x train, and Cisco IOS XE Bengaluru 17.6.4 and later releases of the 17.6.x train. From Cisco IOS XE Cupertino 17.9.1, RUM report throttling is applicable to all subsequent releases.

Virtual Routing and Forwarding (VRF) Support

On a product instance where VRF is supported, you can configure the license smart vrf vrf_string command and use a VRF to send licensing data to CSSM, or CSLU, or SSM On-Prem.

Note: When using a VRF, the supported transport types are smartand cslu only.)

For more information, see license smart (global config)

CSCwh73350

Device keeps crashing when processing a firewall feature.

CSCwf67564

Device observes memory leak at process SSS manager.

CSCwf23291

write or do write saves the configuration but the RSA keys /SSH is lost after reload.

CSCwc79115

Device policy commit failure displays notification and alarm from Cisco Catalyst SD-WAN Controller.

CSCwh28680

Device packet duplication performance improvement.

CSCwf55933

Device crashed after Cisco Catalyst SD-WAN Manager running Network-Wide Path Insight.

CSCwh68508

Unexpected reboot after establishing control plane of EVPN MPLS and receiving packets.

CSCvo01546

NHRP reply processing dequeues an unrelated request.

CSCwf82676

CPU usage mismatch between show sdwan system status and show proc cpu platform.

CSCwf03193

Device crash with crashinfo files are generated with segmentation fault, and process IPSEC key engine.

CSCwh08434

OMP route is advertised although the route is not available.

CSCwf26875

Port-channel displayed suspended status applying platform qos port-channel-aggregate.

CSCwf24164

Netflow stops working when flow monitor reaches cache limit in the device.

CSCwh63061

Device displays four additional NR bands support - 1, 3, 7, and 28.

CSCwf65540

Running tests on ThousandEyes Agent causes tracebacks on device running TE in docker container.

CSCwi28227

NAT HSL logging vrf-filter is not working.

CSCwh06834

Using special characters in the password while generating TP displays an invalid TP.

CSCwe14885

VPN is established although the peer is using a revoked certificate for authentication.

CSCwd17272

UTD packet drop due to fragmentation for ER-SPAN traffic.

CSCwe91898

Environmental syslog does not appear when power cord is disconnected from the redundant PS.

CSCwf55243

Device crashes while adding a trustpoint to the router .

CSCwf84522

Unexpected device reboot while classifying packet with CTF (Common Flow Table).

CSCwf62757

Device interface data report interval issue for physical interface.

CSCwh49644

CSDL compliance failure : Use of 3DES by IPSec is denied.

CSCwh32386

Unexpected reload on device due to the critical process fman_fp_image in 17.9.3a.

CSCwe30514

Device reboots with sslproxy and utd enabled.

CSCwh30377

Device data plane crashes in Umbrella/OpenDNS processing due to an incorrect UDP length.

CSCwf34171

Configure replace command fails due to the license UDI PID XXX SN:XXXX line on devices.

CSCwh62116

Device packet dup performance improvement.

CSCwf96980

Unexpected reboot after configuring application redundancy.

CSCwe64779

Device software forced reset during high IPC congestion with IPsec.

CSCwh01425

ITU channel configuration is not working on device.

CSCwh20577

Crashed by Track Client thread at access invalid memory location.

CSCwh00963

Unable to migrate from ADSL to VDSL without reboot on device.

CSCwh36801

Crash in IP input process during tunnel encapsulation.

CSCwh96415

Cannot disable DMVPN logging.

CSCwe85301

Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is deleted.

CSCwh20734

Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is requested and deleted.

CSCwf71557

IPv4 connectivity over PPP not restored after reload.

CSCwc97579

Spoke-spoke cache refresh is not working correctly in case of multiple cache entries for same next hop.

CSCwf11394

Vdaemon debug log must mention port-hop and reason prior to DISTLOC.

CSCwf04866

Keyman process crashes while re-generating SSH key in the device.

CSCwh00332

B2B NAT: When configration IP NAT inside/outside on VASI intereface, the ack/seq number is abnormal.

CSCwf84960

C-NIM-2T: LED L remains green after port shutdown.

CSCwh18120

IKEv2 - The diagnose feature is taking 11% CPU when brining up the session.

CSCwh22414

Warning and critical CPU utilization thresholds not recomputed when using data-plane-heavy mode.

CSCwi01046

PoE module is does not provide enough power to bring up the ports after an unexpected reload.

CSCwc30418

Segmentation fault observed in ikev2_dupe_delete_reason.

CSCwh84068

Device crash after changing NAT HSL configuration.

CSCwi16716

Device crashed upon increasing the gatekeeper cache size.

CSCwh12093

Enable SoS/ROC feature for DSL.

CSCwi06843

Endpoint tracker triggers a CPU Hog.

CSCwi05232

Traceback on device is seen when no dialer interface or peer down.

CSCwi53306

Unknown appID in ZBFW HSL log.

CSCwi10735

ZBF drops transit WAAS PSH/ACK packet due to invalid ACK number.

CSCwi06404

PKI crash after failing a CRL fetch.

CSCwi46997

NAT command not readable after a reload.

CSCwi33168

DSP reports out of range utilization values in SNMP.

CSCwi08171

Device crashes due to Crypto IKMP process.

CSCwi53951

Packets with unicast MAC get dropped on a Port Channel L2 Sub-intf after a router reboot.

CSCwb25507

CWMP : Add vendor specific parameter for NBAR protocol pack version.

CSCwi25737

The device must discard IKE notification messages with incorrect DOI.

CSCwh50510

Device crashes with Segmentation fault(11), Process = NHRP when processing NHRP traffic.

CSCwh80441

Cosmetic 3G issue - device is displayed as unknown.

CSCwh91136

Traffic is not encrypted and droped over IPsec SVTI tunnel.

CSCwe24491

Device: Static NAT with HSRP stops working after removing / adding standby.

CSCwh41497

DDNS update retransmission timer fails to work with a traceback error.

CSCwi51326

CPP CP SVR crashes after decoding all packets to text (using l2 copy) on fia trace.

CSCwi04547

Cisco SD-WAN custom application is marked as invalid.

CSCwi16111

IPv6 TCP adjust-mss not working after delete and reconfigure.

CSCwi63042

Packet drops observed between LISP EID over GRE tunnel.

CSCwi59202

C-NIM-2T cannot boot up in IOS.

CSCwi30529

AAA:Template push fail when aaa authorization is set to local.

CSCwh87343

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability.

For more information, see Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z

Ten0/0/2 from port-channel going to suspended status applying platform qos port-channel-aggregate .

Unexpected reload due to memory corruption when modifying and access list.

CLI template fails to attach to device with error access-denied.

SFP transceiver DOM not working after some time, however interface forwards the traffic as expected.

Netflow stops working when flow monitor reaches cache limit in C8500L.

Output packet bytes calculation biase when we enable QoS on port channel.

NHRP BFD flaps randomly with dynamic tunnel (NHRP phase 3) in DMVPN.

VPN is established although the peer is using a revoked certificate for authentication.

Static NAT DIA inside static routes being advertised over OMP to remote sites.

UTD packet drop due to fragmentation for ER-SPAN traffic.

Crash due to dtl push/pop on wait loop.

Device is crashing while adding a trustpoint to the router.

C8500L interface data report interval issue for physical interface.

Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is being deleted.

configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices.

Device reloads changing the resource profile.

%CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE message is observed in each write config with same crypto value.

QoS more than four remark with set-cos not work.

Packets with L2TP headers cause device to crash.

IOS-XE cpp crash when entering no ip nat create flow-entries .

Device crash with crashinfo files were generated with segmentation fault, process IPSEC key engine.

Static NAT entry gets deleted from running config; but remains in startup config.

EVPN: BUM traffic is not flooded to bridge domain interface.

C8500L - executing show platform hardware qfp active fbd-flowdb dump leads to a crash.

IOS XE debug log should mention port-hop and reason prior to DISTLOC.

SNMP ifindex persist does not work.

FlexVPN: Stale client routes stuck in RIB on FlexServer.

NAT ALG is changing the Call-ID within SIP message header causing calls to fail.

Device freezes for show commands.

C8500L: control connection over L3 Tloc extension failing as no NAT table entry created.

SNMP MIB does not show correct firmware version for LTE module.

MACsec remains marked as secured, but randomly the traffic stops working.

ALG breaks NBAR recognition impacting application firewall performance.

NAT configuration with redundancy, mapping id and match-in-vrf options with no-alias support.

Device crashes unexpectedly due to a fault in the TLSCLIENT_PROCESS.

NAT configuration with no-alias option is not preserved after reload.

NHRP cache entries flood matching a /32 default route.

Watchdog crash while importing a large CRL file.

DTMF is failing through IOS MTP during call on-hold.

C8500 platform uses excessive memory when configuring ACLs with Large Object Groups.

Auto-Update cycle incorrectly deletes certificates.

uCode crash seen on device with traffic pointing to segfault in coff handler.

Memory allocation failure with extended antireplay enabled.

NAT entries expire on standby device.

Segmentation fault when per-tunnel qos config withdraw.

Unexpected reboot due to IOSXE-WATCHDOG prrocess.

Platform punt-policer is not configurable.

SNMP MIB OID changing its last index.

Device is crashing after importing the trustpoint with rsakeypair.

Unexpected reload with IPS.

Observed qfp-ucode-wlc crash.

GARP on port up/up status from device is not received by remote peer device.

MCID (Malicious Call Identification) gets broken due to custom prefix setting under STCAPP FAC.

NAT: Traffic is not translated to the same global address though PAP is configured.

Device can lose its config during a triggered resync process if lines are in an off-hook state.

No way audio when using secure hardware conference with secure endpoints.

Device race condition causes no ringing for analog phones.

Configuring entity-information xpath filter causes syslogs to print, does not return data.

C8500-12X ~23% degradation in IPSEC IPv6 profile for 1400B.

Device crashes due to CPUHOG when walking ciscoFlashMIB @snmp_platform_get_flash_file_info.

Device IOS-XE crash while executing AES crypto functions.

Device packet duplication: duplicate packets are counted on primary tunnel interface statistics.

ISAKMP profile doesn't match as per configured certificate maps.

Failed to ping gateway while configuring SharedLOM with console, TE1 interface until router reload.

ISG: L2-connected subscriber: IPv6 prefix delegation is not reachable when packet are switched.

Ten0/0/2 from port-channel going to suspended status applying platform qos port-channel-aggregate .

Unexpected reload due to memory corruption when modifying and access list.

CLI template fails to attach to device with error access-denied.

SFP transceiver DOM not working after some time, however interface forwards the traffic as expected.

Netflow stops working when flow monitor reaches cache limit in C8500L.

Output packet bytes calculation biase when we enable QoS on port channel.

NHRP BFD flaps randomly with dynamic tunnel (NHRP phase 3) in DMVPN.

VPN is established although the peer is using a revoked certificate for authentication.

Static NAT DIA inside static routes being advertised over OMP to remote sites.

UTD packet drop due to fragmentation for ER-SPAN traffic.

Crash due to dtl push/pop on wait loop.

Device is crashing while adding a trustpoint to the router.

C8500L interface data report interval issue for physical interface.

Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is being deleted.

configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices.

Device reloads changing the resource profile.

%CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE message is observed in each write config with same crypto value.

QoS more than four remark with set-cos not work.

Packets with L2TP headers cause device to crash.

IOS-XE cpp crash when entering no ip nat create flow-entries .

Device crash with crashinfo files were generated with segmentation fault, process IPSEC key engine.

Static NAT entry gets deleted from running config; but remains in startup config.

EVPN: BUM traffic is not flooded to bridge domain interface.

C8500L - executing show platform hardware qfp active fbd-flowdb dump leads to a crash.

IOS XE debug log should mention port-hop and reason prior to DISTLOC.

SNMP ifindex persist does not work.